@js-joda/core

Build provenancecaution

The release has no build attestation or trusted-publisher identity, limiting verification of how the published artifact was produced.

Repo toolingcaution

The project uses established build tools including webpack, Rollup, TypeScript, Babel, and npm scripts. No security scanning tools were detected, leaving a modest transparency gap.

Security policycaution

No repository security policy was found. This does not indicate unsafe code, but it gives maintainers and users less guidance for reporting vulnerabilities.

Workflow auditcaution

All 6 of 6 analyzed action references are unpinned, and one workflow grants top-level write permissions; no untrusted checkout, injection, or high-confidence audit findings were reported.